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Defense  Information  Systems  Agency 
Right-Sizing  Plan  for  Regional  Support  Activities 


Executive  Summary 


Introduction.  The  Defense  Information  Systems  Agency  developed  a  plan  to  resize  the 
regional  support  activities  infrastructure  as  part  of  the  goal  to  ensure  that  all  regional 
support  activities  are  self-sustaining.  An  Internal  Control  Plan  for  Right  Sizing 
Regional  Support  Activities  was  developed  and  approved  by  the  Director,  Defense 
Information  Systems  Agency,  on  October  7,  1999.  The  Internal  Control  Plan 
establishes  the  policies,  responsibilities,  and  procedures  to  guide  the  process  for 
balancing  revenue  and  costs  at  the  regional  support  activities.  A  Right-Sizing 
Management  Plan  for  Regional  Support  Activities  was  also  developed  and  approved  by 
the  Director,  Defense  Information  Systems  Agency,  on  February  29,  2000.  The 
Management  Plan  describes  the  implementation  procedures  for  the  right-sizing  process. 
The  Director,  Defense  Information  Systems  Agency,  requested  that  the  Inspector 
General,  DoD,  review  the  plan  in  advance  of  its  implementation  to  ensure  that  the 
decisionmaking  process  is  equitable  and  defendable,  with  respect  to  the  regional  support 
activities.  For  additional  information  on  the  audit  process,  see  Appendix  A. 

Objectives.  The  audit  objective  was  to  determine  whether  the  Defense  Information 
Systems  Agency  plan  for  right-sizing  their  regional  support  activities  conforms  to  the 
organizational  goals  and  is  consistent  with  DoD  policy  and  regulations.  We  also 
reviewed  the  adequacy  of  the  management  control  program  as  it  applied  to  the  audit 
objective. 

Results.  The  Defense  Information  Systems  Agency  right-sizing  plan  for  its  regional 
support  activities  conforms  to  the  organizational  goals  of  fairness,  impartiality, 
objectivity,  and  defensibility,  and  is  consistent  with  DoD  policy  and  regulations.  The 
management  controls  that  we  reviewed  were  effective  in  that  no  material  management 
control  weakness  was  identified  in  the  regional  support  activities  right-sizing  planning 
process.  See  Appendix  A  for  details  on  the  management  control  program. 

Management  Comments.  We  provided  a  draft  of  this  report  on  July  3,  2000.  No 
written  response  was  required,  and  none  were  received.  Therefore,  we  are  publishing 
this  report  in  final  form. 


Table  of  Contents 


Executive  Summary 


i 


Introduction 

Background  1 

Objectives  1 

Finding 

Defense  Information  Systems  Agency  Right-Sizing  Plan  for  Regional 

Support  Activities  2 

Appendixes 

A.  Audit  Process 

Scope 

Methodology 

Management  Control  Program 
Prior  Coverage 

B.  Report  Distribution 


vJOsOMhU 


Background 


The  Defense  Information  Systems  Agency  (DISA)  provides  computer 
information  technology  support  to  DoD  Military  Departments  and  Defense 
agencies.  DISA  provides  that  support  through  22  regional  support  activities 
(RSAs)  located  throughout  the  continental  United  States  and  the  Pacific.  Six  of 
the  RSAs  are  collocated  with  mainframe  processing  sites  and  the  three  RSAs  in 
the  Pacific  are  identified  as  Information  Technology  Centers. 

The  Deputy  Secretary  of  Defense  approved  the  Defense  Megacenter  Business 
Strategy  on  November  12,  1997.  The  business  strategy  introduces  the  RSA 
concept  and  states  that  all  RSAs  must  be  self-sustaining  and  cannot  be 
subsidized  by  other  sites  or  by  mainframe  processing.  The  director  also 
requested  that  the  Inspector  General,  DoD,  assist  in  a  review  of  the  plan  and 
analysis  of  the  RSA  right-sizing  process. 


Objectives 

The  audit  objective  was  to  determine  whether  the  DISA  plan  for  right-sizing 
their  regional  support  activities  conforms  to  the  organizational  goals  and  is 
consistent  with  DoD  policy  and  regulations.  We  also  reviewed  the  adequacy  of 
the  management  control  program  as  it  applied  to  the  audit  objective.  See 
Appendix  A  for  a  discussion  of  the  audit  process  and  the  review  of  the 
management  control  program. 
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Defense  Information  Systems  Agency 
Right-Sizing  Plan  for  Regional  Support 
Activities 

The  Defense  Information  Systems  Agency  right-sizing  plan  for  its 
regional  support  activities  is  consistent  with  DoD  policy  and  regulations, 
and  conforms  to  the  organizational  goals  of  fairness,  impartiality, 
objectivity,  and  defensibility.  Therefore,  the  plan  can  properly  provide  a 
framework  for  implementing  the  right-sizing  process. 


RSA  Self-Sustaining  Requirement 

The  Deputy  Secretary  of  Defense  approved  the  DISA  Defense  Megacenter 
Business  Strategy  on  November  12,  1997.  DISA  is  involved  in  a  Quadrennial 
Defense  Review  and  Defense  Reform  Initiative,  a  mandated  effort  to  ensure 
that  the  RSAs  are  self-sustaining.  All  RSAs  operate  on  a  fee-for-service  basis, 
and  are  expected  to  operate  on  a  full-cost-recovery  basis;  that  is,  each  RSA 
must  generate  revenues  from  services  performed  for  its  customers  that  equals 
the  total  RSA  costs.  To  accomplish  this  goal,  DISA  developed  an  internal 
control  plan  and  a  management  plan  to  establish  and  implement  an  RSA 
infrastructure  right-sizing  process. 


Internal  Control  Plan 


The  “Internal  Control  Plan  for  Right-Sizing  Regional  Support  Activities,”  (the 
Internal  Control  Plan)  was  approved  by  the  Director,  DISA  on  October  7,  1999. 
The  Internal  Control  Plan  establishes  the  policies,  responsibilities,  and 
procedures  to  guide  the  process  for  balancing  revenue  and  costs  at  the  RSAs. 

To  ensure  that  the  right-sizing  process  is  impartial,  the  Internal  Control  Plan 
establishes  a  project  organization,  tasked  with  managing  the  process,  which  is 
“clearly  separate  from  RSA  operations.”  In  accordance  with  this  impartiality 
principle,  the  Internal  Control  Plan  articulates  a  multitier  organization  to 
manage  the  right-sizing  process. 

•  Director,  DISA.  Internal  Control  Plan  designates  the  Director, 
DISA,  as  the  “senior  approval  authority”  for  the  RSA  right-sizing 
process.  The  director  is  tasked  with  approving  the  Internal  Control 
Plan  and  the  Management  Plan,  and  must  approve  any  involuntary 
personnel  actions  resulting  from  the  right-sizing  process. 

•  Executive  Group.  The  executive  group  assists  the  director  as  an 
advisory  body.  It  is  chaired  by  the  Deputy  Director  for  Strategic 
Plans  and  Policy  and  is  composed  of  various  DISA  organization 
heads.  Specific  responsibilities  of  the  executive  group  include: 
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approval  of  data  collection  plans,  approval  of  right-sizing  actions  for 
designated  sites,  review  of  right-sizing  action  implementation,  and 
oversight  of  the  right-sizing  working  group. 

•  Working  Group.  The  working  group  identifies  issues  and 

documents  decisions  relating  to  the  right-sizing  process.  It  is  chaired 
by  the  Chief,  Defense  Computing  Business  Office,  and  is  composed 
of  representatives  from  the  DISA  Comptroller  and  the  DISA  field 
command  with  geographic  responsibility  for  the  Western  Hemisphere 
Theater  (WESTHEM).  The  working  group  is  tasked  with  developing 
the  Internal  Control  Plan  and  the  Management  Plan,  developing  the 
plans  for  collecting  data  to  be  used  in  the  right-sizing  decision 
process,  and  coordinating  with  the  various  field  organizations. 

The  Internal  Control  Plan  also  establishes  general  procedural  rules  for  collecting 
data  to  be  used  in  the  right-sizing  process  and  establishes  milestones  for 
completing  the  process. 


Management  Plan 

The  Director,  DISA,  approved  the  Management  Plan  on  February  29,  2000.  The 
Management  Plan  describes  the  process  that  will  be  used  to  ensure  that  RSAs  and 
Information  Technology  Centers  operate  in  a  self-sustaining,  full-cost-recovery 
manner.  Under  the  Management  Plan,  an  “executive  group”  composed  of  various 
members  of  the  DISA  upper  management  will  be  tasked  with  overseeing  the  right- 
sizing  process;  however,  any  involuntary  personnel  actions  resulting  from  the 
process,  such  as  reduction-in-force  actions,  will  require  approval  by  the  Director, 
DISA.  The  plan  outlines  a  repeating  annual  process  where  a  management 
evaluation  of  the  RSA  performance  and  financial  status,  and  resultant  corrective 
actions,  occur  on  an  18-month  cycle.  DISA  expects  this  process  to  continue 
indefinitely  until  the  executive  group  overseeing  the  right-sizing  plan  determines 
that  it  is  no  longer  needed. 

The  Management  Plan  states  that  the  RSA  right-sizing  process  is  intended  to 
achieve  the  following  goals: 

•  ensure  the  continuity  of  critical  military  functions; 

•  ensure  that  RSAs  are  competitive,  based  on  price  and  performance;  and 

•  balance  costs  and  revenues  in  the  RSAs. 


Inspector  General,  Department  of  Defense,  Review 

The  DISA  right-sizing  plan  for  its  regional  support  activities  conforms  with  the 
organizational  goals  of  fairness,  impartiality,  objectivity,  and  defensibility,  and 
'  is  consistent  with  DoD  policy  and  regulations.  The  audit  initially  identified  one 
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concern  regarding  planned  IG,  DoD,  involvement  in  the  Management  Plan’s 
implementation;  however,  DISA  management  adequately  addressed  that  concern 
during  the  course  of  the  audit.  Therefore,  the  plan  can  properly  provide  a 
framework  for  implementing  the  DISA  right-sizing  process. 

IG,  DoD,  Review  of  Right-Sizing  Process.  Paragraphs  3. 4. 1.1  and  3.4.1. 2  of 
the  Management  Plan  state  that  DISA  WESTHEM  must  identify  and  review  all 
policies  and  practices  related  to  the  allocation  of  overhead  and  cost  transfers 
among  the  RSAs.  After  reviewing  those  policies  and  practices,  the 
Commander,  DISA  WESTHEM,  must  certify  that  they  are  equitable  and  in 
accordance  with  all  applicable  Defense  Working  Capital  Fund  guidance. 
Paragraph  3. 4. 3. 4  states  that  DISA  will  request  that  the  IG,  DoD,  review  the 
accuracy  and  completeness  of  the  data  used  in  the  right-sizing  process,  and 
verify  that  overhead  is  allocated  in  a  fair  and  equitable  manner  among  the 
RSAs. 

We  suggested  that  the  right-sizing  plan  could  be  implemented  more 
expeditiously  if  IG,  DoD,  preemptively  reviewed  the  policies  and  practices  for 
allocating  overhead  and  cost  transfers  contemporaneously  with  the  DISA 
review.  In  the  event  that  IG,  DoD,  identified  problems  with  the  overhead  or 
cost  transfer  allocation  methodology,  DISA  would  have  the  opportunity  to  revise 
its  policies  or  practices  at  the  first  instance,  rather  than  relying  on  a  potentially 
flawed  methodology.  However,  the  Chief,  Defense  Computing  Business  Office, 
DISA  stated  that  while  WESTHEM  had  not  yet  completed  management  reviews 
of  its  field  activities  as  called  for  by  the  Management  Plan,  it  would  not  be 
appropriate  for  the  IG,  DoD,  to  preemptively  review  those  same  policies  and 
procedures.  The  chief  further  stated  that  when  the  year-end  financial  data  is 
available,  the  IG,  DoD,  will  have  sufficient  time  to  validate  policies  and 
procedures  for  overhead  allocation  and  cost  transfers,  and  to  analyze  whether 
each  RSA  was  treated  fairly  and  equitably.  DISA  agreed  to  revise  the 
Management  Plan  accordingly. 


Summary 


No  discrepancies  were  found  in  the  DISA  Internal  Control  Plan.  Minor 
discrepancies  were  identified  in  the  DISA  Management  Plan,  which  DISA 
corrected  during  the  execution  of  this  audit.  Therefore  the  plan  for  the 
decisionmaking  process  is  equitable  and  defendable.  Accordingly,  there  are 
no  recommendations  in  this  report. 
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Appendix  A.  Audit  Process 


Scope 

Work  Performed.  We  reviewed  the  approved  DISA  Internal  Control  Plan  and 
Management  Plan  for  the  right-sizing  process,  interviewed  cognizant  DISA 
personnel,  and  reviewed  other  DISA  documentation  applicable  to  the  audit 
objectives. 

DoD-Wide  Corporate  Level  Government  Performance  and  Results  Act 
(GPRA)  Coverage.  In  response  to  the  GPRA,  the  Secretary  of  Defense 
annually  establishes  DoD-wide  corporate  level  goals,  subordinate  performance 
goals,  and  performance  measures.  This  report  pertains  to  achievement  of  the 
following  goal  and  subordinate  performance  goal: 

•  FY  2000  DoD  Corporate  Goal  2:  Prepare  now  for  an  uncertain 
future  by  pursuing  a  focused  modernization  effort  that  maintains  U.S. 
qualitative  superiority  in  key  warfighting  capabilities.  Transform  the 
force  by  exploiting  the  Revolution  in  Military  Affairs  and  reengineer 
the  Department  to  achieve  a  21st  century  infrastructure. 

•  FY  2000  Subordinate  Performance  Goal  2.3:  Streamline  the  DoD 
infrastructure  by  redesigning  the  Department’s  support  structure  and 
pursuing  business  practice  reforms  (00-DoD-2.3). 

General  Accounting  Office  High-Risk  Area.  The  General  Accounting  Office 
has  identified  several  high-risk  areas  in  the  Department  of  Defense.  This  report 
provides  coverage  of  the  Defense  Infrastructure  high-risk  area. 


Methodology 

Use  of  Computer-Processed  Data.  We  did  not  use  computer-processed  data  to 
perform  this  audit. 

Audit  Type,  Dates,  and  Standards.  This  economy  and  efficiency  audit  was 
performed  from  April  to  May  2000,  in  accordance  with  auditing  standards  issued 
by  the  Comptroller  General  of  the  United  States,  as  implemented  by  the  Inspector 
General,  DoD. 

Contacts  During  the  Audit.  We  visited  or  contacted  organizations  within 
DoD.  Further  details  are  available  on  request. 
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Management  Control  Program 


DoD  Directive  5010.38,  “Management  Control  (MC)  Program,”  August  26, 
1996,  requires  DoD  organizations  to  implement  a  comprehensive  system  of 
management  controls  that  provides  reasonable  assurance  that  programs  are 
operating  as  intended  and  to  evaluate  the  adequacy  of  the  controls. 

Scope  of  the  Review  of  the  Management  Control  Program.  We  reviewed  the 
adequacy  of  DISA  management  controls  over  development  of  its  RSA  right- 
sizing  plan.  Specifically,  we  reviewed  the  DISA  “Internal  Control  Plan  for 
Right-Sizing  Regional  Support  Activities”  to  determine  whether  the  plan 
established  adequate  controls  over  the  RSA  right-sizing  planning  process. 
Because  we  did  not  identify  a  material  weakness,  we  did  not  assess 
management’s  self-evaluation. 

Adequacy  of  Management  Controls.  DISA  management  controls  over  the 
RSA  right-sizing  planing  process  were  adequate  in  that  we  identified  no  material 
management  control  weaknesses. 


Prior  Coverage 


No  prior  coverage  has  been  conducted  on  the  subject  during  the  last  5  years. 
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Appendix  B.  Report  Distribution 


Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition,  Technology,  and  Logistics 
Deputy  Under  Secretary  of  Defense  (Industrial  Affairs  and  Installations) 

Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications  and  Intelligence) 


Department  of  the  Army 

Auditor  General,  Department  of  the  Army 

Department  of  the  Navy 

Naval  Inspector  General 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 
Auditor  General,  Department  of  the  Air  Force 

Other  Defense  Organizations 

Director,  Defense  Information  Systems  Agency 


Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 
General  Accounting  Office 

National  Security  and  International  Affairs  Division 
Technical  Information  Center 
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Congressional  Committees  and  Subcommittees,  Chairman  and 
Ranking  Minority  Member 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 
Senate  Committee  on  Armed  Services 
Senate  Committee  on  Governmental  Affairs 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 
House  Committee  on  Armed  Services 
House  Committee  on  Government  Reform 

House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform 

House  Subcommittee  on  National  Security,  Veterans  Affairs,  and  International 
Relations,  Committee  on  Government  Reform 
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